The reported issue is a heap‑based buffer overflow in Microsoft’s Remote Desktop Client. An attacker who can send specially crafted data over the network to the Remote Desktop service may trigger the overflow, allowing the execution of arbitrary code. The resulting compromise would enable the attacker to run commands with the client’s privileges, potentially giving full control over the affected system.

Affected are the Remote Desktop client for Windows Desktop and its Windows App Client, as well as all listed Windows 10 and Windows 11 releases from version 1607 to 26H1 and the corresponding Windows Server versions from 2012 to 2025. The vulnerability spans both x86 and x64 architectures, including ARM64 for newer Windows 11 builds.

The CVSS score of 7.5 indicates high severity, and although the EPSS score is not available, the lack of a KEV listing does not diminish the risk: the vulnerability can be exploited remotely over the network by an unauthorized actor. The likely attack vector is a network‑based Remote Desktop session, where the attacker sends malicious packets to trigger the buffer overflow and achieve remote code execution. The impact on confidentiality, integrity, and availability is significant, as full system control can be obtained without user interaction.